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ESM Management Comments on Board of Auditors' 
Annual Report to the Board of Governors 
forthe period ended 31 December2014 


□ear Chairperson, 

I would like to thank you for the opportunity to provide 
management comments on the Board of Auditors' 
Annual Report to the Board of Governors for the 
period ended 31 December 2014. 

□uring the past year, the ESM management continued 
its collaborative relationship with the Board of Auditors. 
In 2014, the Board of Auditors held nine meetings and 
met once with the Board of Directors. Furthermore, 
the Chairperson of the Board of Auditors met with the 
Chairperson of the Board of Governors and attended 
the annual meeting of the Board of Governors. To date 
in 201 5, the Board of Auditors has held four meetings. 
During these meetings, the Board of Auditors was 
regularly updated on ESM activities, the work of the 
ESM governing bodies, and other relevant issues and 
developments. Key staff members, including the ESM 
management, devoted considerable time and effort 
to discuss relevant issues, to submit written notes in 
response to questions raised, and to provide any other 
cooperation and assistance needed for the successful 
discharge of the mandate of the Board of Auditors. 

Furthermore, the Board of Auditors met regularly 
with the internal audit function and monitored and 


reviewed the work of the external auditor. In response 
to the previously issued Board of Auditors’ recommen- 
dation, the ESM performed a competitive procure- 
ment procedure for the selection of an independent 
external auditor for the financial years 2014-2016. 
To ensure full transparency and process quality, the 
ESM invited members of the Board of Auditors to 
serve as independent observers. The ESM manage¬ 
ment also specifically reflected the Board of Auditors’ 
access to the working papers of the external auditor 
as a mandatory requirement for the engagement. 
PricewaterhouseCoopers, Luxembourg ("PwC”) obtained 
the highest score in the procurement procedure 
and was subsequently appointed by the Board of 
Governors as the independent external auditor for 
a three-year term. 

The Board of Auditors, as part of its duties, also 
reviewed the ESM financial statements as of 
31 December 2014 [the “Financial Statements”) as 
well as the working papers of the external auditor 
on the statutory audit of the Financial Statements. 
Subsequently, the Board of Auditors prepared 
a report in respect of the Financial Statements 
which is included in the ESM 2014 Annual Report 
along with the Financial Statements and the external 
auditor’s opinion. 
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Audit Procedures Conducted in 2014 


AUDIT PROCEDURES CONDUCTED 
BY THE BOARD OF AUDITORS 

The ESM is subject to significant independent audit 
review thnoughout the year, as well as at year-end. 
In addition to the annual external audit, the Board 
of Auditors carried out several independent audits in 
accordance with Article 30 (3) of the ESM Treaty. In 
January 2014 the Board of Auditors carried out an audit 
of the ESM Risk Management, and in November 2014, 
an audit of the ESM Lending Operations. Furthermore, 
in February 2015, a follow-up audit of the ESM Risk 
Management was conducted. 

In line with Article 24 (5) of the ESM By-Laws, the 
Board of Auditors appointed two subject matter 
experts from the German Supreme Audit Institution 
(Bundesrechnungshof) to support its audit work. The 
ESM dedicated significant time and effort to providing 
ail the necessary cooperation and support required 
for the successful completion of these audits. 

AUDIT PROCEDURES CONDUCTED 
BY THE INTERNAL AUDIT FUNCTION 

The Internal Audit function reported that the 2014 
Audit Plan approved by the ESM management and 
presented to the Board of Auditors, had been accom- 
plished and that the ESM had made sustained efforts 
in the clearance of outstanding internal audit recom- 
mendations. Ouring the past year, the Internal Audit 
function performed eight audits, on matters such as 
business continuity, asset and liability management, 
outsourcing controlling, funding, as well as investment 
and treasury. No high-risk recommendations were 
outstanding at the end of March 2015. The ESM 
management agreed that, going forward, greater 
emphasis would be placed upon the timely closure 
of internal audit recommendations, including those 
classified as medium and low risk. 


The Internal Audit function had full, free and unre- 
stricted access to the Board of Auditors throughout 
the year. There have been seven meetings between 
the Internal Audit function and the Board of Auditors 
in 2014 and three further meetings to date in 201 5. 
The Internal Audit function reported to the Board 
of Auditors on: the results of the internal audits 
conducted, the progress in implementing the Annual 
Audit Plan; and, on a quarterly basis, the implementa- 
tion status of the internal audit recommendations as 
well as the recommendations issued by the Board of 
Auditors and the independent external auditor. 

AUDIT PROCEDURES CONDUCTED BY 
THE INDEPENDENT EXTERNAL AUDITOR 

The independent external auditor PwC carried out 
the statutory audit and issued an unqualified audi- 
tor's report confirming that based on the audit, the 
Financial Statements give a true and fair view of the 
ESM financial position, financial performance and 
cash flow as of 31 December 2014. The statutory 
audit consisted of a preliminary audit conducted from 
November through December 2014, and a final 
audit review of the Financial Statements conducted 
from January through March 2015. As part of its 
annual audit, PwC also reviewed the principal internal 
control procedures in place in order to ensure the 
accuracy and reliability of ESM accounting records 
and the safekeeping of assets. The independent exter¬ 
nal auditor conducted the audit in accordance with 
the International Standards on Auditing as adopted 
for Luxembourg by the "Commission de Surveillance 
du Secteur Financier”. During the extensive tests of 
Controls performed as part of the statutory audit, no 
exceptions were noted. Furthermore, PwC confirmed 
that unlimited access to documents and staff had 
been granted and noted very good cooperation by the 
ESM management. 



ESM Internal Control Framework 


Since the last Board of Auditors' Annual Report to 
the Board of Governors in June 2014, the ESM has 
progressed significantly in consolidating and finalising 
processes, procedures and internal Controls across 
all areas of the institution. 

The ESM recognises the importance of effective 
internal Controls which provide the foundation for the 
safe and sound operation of the institution. In October 
2013, as part of the maturing of the institution, the 
Board Risk Committee supported the implementation 
of the principles of the Basel Committee’s Framework 
for Internal Control Systems in Banking Organisations. 

Since then, the ESM has made important strides 
in further developing its internal Controls with the 
objective of completing a comprehensive and effective 
internal control system aligned with best practices 
by the end of 2015. During the past year, the ESM 
developed an Internal Control Roadmap which iden- 
tified the remaining elements outstanding and the 
steps required to achieve this objective. To address 
these, the ESM rolled out a major institution-wide 
project and dedicated significant internal and external 
resources during 2014 and 2015 to finalise the ESM 
internal control framework. The project is currently 
75 percent complete and all outstanding elements will 
be fully in place as of year-end 2015. 


With the completion of the Internal Control Roadmap, 
the ESM will translate the Basel Committee’s internal 
control principles into relevant entity level, process 
level, and information technology Controls, consistent 
with the nature, complexity and risks inherent in ESM 
activities. The internal control framework will thus 
complement the three lines of defence governance 
model which the Board of Directors established with 
the ESM Risk Policy. 

The independent external auditor acknowledged these 
efforts, noting good progress on the recommenda- 
tions issued in last year’s Management Letter. PwC 
confirmed that the internal control environment had 
significantly improved compared to the previous year 
in terms of staff allocated to the second and third 
line of defence as well as the organisational effort 
dedicated to the strengthening of internal Controls. 

I now turn to the detailed recommendations issued 
in the Board of Auditors’ Annual Report to the Board 
of Governors. In line with Article 24 (8) of the ESM 
By-Laws, the ESM management would like to provide 
the following comments in this regard: 
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1. Follow-uptothe 2013 Board of Auditors' Annual Report 
to the Board of Governors 


- ESM Internal Control Framework 

As noted earlier, the ESM substantially enhanced 
its internal control framework over the past year in 
order to meet best practice standards. As such, the 
ESM rolled out a major institution-wide project and 
deployed significant resources to the strengthening of 
the internal control system in order to fully align with 
the Basel Committee’s Framework for Internal Control 
Systems in Banking Organisations. The ESM made this 
alignment one of its institutional priorities and these 
efforts will allow the ESM management to confirm the 
adequacy and effectiveness of ESM internal Controls 
as of 31 December 2G15. 


- ESM Financial Controls and 
Financial Reporting 

As part of the ongoing internal control initiative, the 
ESM strengthened the Finance & Control function 
and its underlying Controls. As such, procedures 
and Controls over the completeness and accuracy of 
accounting entries were enhanced. 

To address fully the recommendations issued by the 
Board of Auditors and the independent external 
auditor, the ESM also implemented an IT accounting 
module for its financial system in May 2015. The 
module automates the generation of accounting 
entries for all financial transactions and reduces the 
number of manual interventions required. The ESM 
expects that these efforts should fully address the 
recommendations issued in this regard. 

- “Fit for purpose” Analysis of the ESM 
accounting frameuuork 

□n 13 December 2012, the Board of Directors 
adopted a resolution implementing the EU Accounting 
Directive (Fourth Council Directive 78/BBO/ 
EEC of 25July 1978, as amended) and the EU 
Banking Directive (Council Directive 86/635/EEC of 
8 December 198B, as amended) as the applicable 
ESM accounting framework. The Board of Auditors 
approved this decision on 16 January 2013 subject 
to the subsequent completion of a "fit for purpose" 
analysis of the adopted ESM accounting framework. 
Accordingly, the ESM performed its first “fit for pur¬ 
pose” analysis in May 2014, after completion of the 


first full financial year of activity. This in-depth analysis 
was performed by internal resources with external 
expertise provided by Deloitte, Luxembourg. 

The “fit for purpose” analysis concluded that the 
approved ESM accounting framework fits the spe- 
cific purpose of the ESM, its political mandate and 
long-term financial assistance strategy, while providing 
all relevant information to the addressees of the 
Financial Statements. 

The analysis was extensively discussed with the Board 
of Auditors and updated to reflect the comments 
provided. Following these discussions, the Board of 
Auditors agreed to conclude its deliberations on the 
matter, subject to the ESM performing a continuous 
review and assessment of the suitability of the ESM 
accounting framework in case of changes in ESM 
activities or the accounting landscape. 

Accordingly, the ESM is monitoring the accounting 
environment with view to any upcoming changes and 
developments: 

□n 29 June 2013, the new EU Accounting Directive 
(Directive 2013/34/EU of the European Parliament 
and of the Council of 2B June 2013) was published in 
the Official Journal of the European Union. This new 
Directive repeals the current EU Accounting Directive. 
The ESM will adhere to the same transposition period 
applicable to the Member States and will therefore 
implement the Directive for the financial year com- 
mencing on 1 January 201B and onwards. 

The new EU Accounting Directive re-casts the cur¬ 
rent EU Accounting Directive and Council Directive 
83/349/EEC of 13 June 1983 on Consolidated 
accounts. Consequently, many of the provisions in 
the new EU Accounting Directive have been carried 
over from earlier directives. The ESM is currently 
assessing the implications for the financial reporting 
process and will finalise a comprehensive gap anal¬ 
ysis in preparation of the application of the new EU 
Accounting Directive in 201B. 

In addition to the applied ESM Accounting Framework, 
the ESM is continuing to closely follow the devel¬ 
opments in relation to the International Financial 
Reporting Standards (“IFRS”), including the IFRS 9 
Financial Instruments, which will become effective no 
earlier than 2018. 



The ESM is assessing the implications of the new EU 
Accounting Dinective as well as any developments 
regarding the IFRS in consultation with external 
accounting experts. In addition, the ESM seeks reg- 
ular information exchanges with peer institutions on 
these matters. 

As such, based on the continuous assessment 
performed by the ESM, neither ESM activities and 
operations, nor current legislation have changed sig- 
nificantly since the approval of the applied accounting 
framework by the Board of Directors in December 
2012 and the Board of Auditors in January 2013. 
Therefore no revision of the applied accounting frame¬ 
work is currently required. 

- Adoption of the “EU Regulatory 
Framework” and ESM Procurement Policy 

The ESM has noted that the Board of Auditors reiter- 
ated its recommendation that "the ESM adopts the EU 
regulatory framework as its own”. As already outlined 
in previous years, this frame of reference does not rec- 
oncile directly with the ESM status as an international 
financial institution outside the EU framework. The 
ESM regulatory frame of reference is the ESM Treaty 
ratified by the 19 euro area Member States, and the 
ESM By-Laws, as adopted by the Board of Governors. 


This rationale also applies to the ESM procurement 
policy. Taking this into account and similar to other 
international financial institutions, the ESM had initially 
implemented a procurement framework corresponding 
to its legal status as an international financial institution. 
While such procurement policy observes the fundamen- 
tal principles of the EU Directive on Public Procurement 
of fair treatment, transparency, non-discrimination, 
mutual recognition and proportionality, it also reflects 
the specific context and operating model of the ESM. 

In response to the recommendation of the Board of 
Auditors, the ESM extensively reviewed various alter¬ 
naties for the further development of its procurement 
framework as well as the associated costs and bene- 
fits linked to these alternaties. Following a technical 
consultation with experts from the ESM Members and 
a subsequent discussion with the Board of Directors 
in May 2015, the ESM is currently in the process of 
implementing the thresholds and key elements of the 
EU Directive on Public Procurement while preserving 
a certain degree of efficiency and flexibility in the 
procurement procedures and timeframes. 

The ESM will thus address the Board of Auditors’ 
recommendation later in 2015 by implementing 
a "substance over form” approach to its alignment with 
the EU public procurement rules, commensurate with 
its special mandate, relative size and operating model. 
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2. Findings and Recommendations of the 2014 Board 

of Auditors' Annual Report to the Board of Governors 


EXTERNAL AUDIT 


- Procurement procedure for the 
external auditor and Board of 
Auditors’ access to the uvorking 
papers of the external auditor 

The ESM performed a competitive procurement pro¬ 
cedure for the selection of the independent external 
auditor for the 2014 - 2016 ESM statutory audits. 
To ensure full transparency and process quality, 
the ESM invited members of the Board of Auditors 
to serve as independent observers. PwC obtained 
the highest score amongst aii candidates for the 
engagement and was subsequently appointed by 
the Board of Governors for a three-year term. 

The audit engagement letter reflected the Board of 
Auditors’ requirements on the terms of the external 
audit engagement, including the Board of Auditors’ 
access to the working papers of the independent 
external auditor. 


- Long-form audit report 

Regarding the Board of Auditors' recommendation 
for the issuance of a long form report by the 
independent external auditor, the ESM would like to 
recall that this topic was discussed during the joint 
Board of Directors and Board of Auditors meetings 
on 13 June 2013 in Rome and on 13 June 2014 
in Lisbon. The Board of Directors repeatedly 
supported the view that a long form report would 
not be suitable for the ESM as an international 
financial institution. Long form reports are generally 
a requirement that national bank supervisors issue 
for banking institutions. Furthermore, such a long 
form report and the related additional audit proce¬ 
dures may not fall within the scope of the external 
auditor's mandate pursuant to the ESM By-Laws. 

Since 2013, the external auditor has been comple- 
menting the Management Letter with an additional 
“Special Topic Report’’ on a matter relevant to the 
financial reporting process selected in consultation 
with the Board of Auditors. As such, the 2014 
Special Topic Report assessed the ESM manage¬ 
ment reporting system and its linkages to the 
Financial Statements. 


Furthermore, for 2015 and onwards the ESM is 
planning to look into the preparation of an additional 
report in line with Article 11 of the recently issued 
Regulation [EU] No 537/2014 on specific require¬ 
ments regarding statutory audits of public-interest 
entities. Such an additional report could replace 
the 2015 Special Topic Report if it is found to be 
better suited to addressing the Board of Auditors' 
recommendation in this regard. 

- Management Letter recommendations 

The independent external auditor confirmed overall 
good progress in addressing the recommendations 
issued in the 2013 Management Letter. Out 
of three recommendations the external auditor 
included in last year’s Management Letter, one has 
been completed and closed and no new findings or 
recommendations have been issued for this year. 

As outlined above, the ESM made significant 
progress on the two remaining recommendations 
which relate to the strengthening of the internal 
control environment, and the accounting system and 
organisation. With the completion of the Internal 
Control Roadmap and the automated accounting 
module, both of these recommendations should be 
fully addressed as of year-end 201 5. 

INTERNAL AUDIT 


- Staffing of the internal audit function 

In accordance with the Board of Auditors' recom¬ 
mendation, the ESM recruited a second internal 
auditor as of the beginning of June 2014. Two 
experienced auditors now staff the Internal Audit 
function. They will continue to have access to 
external experts for the completion of the Annual 
Audit Plan agreed with the Board of Auditors and 
the ESM management. This combined sourcing 
model reflects the overall ESM operating model 
and ensures additional internal audit resources 
and specialised technical skill that specific audits 
may require. 

The ESM management will continue its efforts to 
proactively support and strengthen the internal audit 



function as a third line of defence and to address 
any outstanding internal audit recommendations in 
a timely mannen 

- “Right to audit” clause for external 
service providers 

The ESM has developed a “right to audit” clause and 
has been successful in gradually introducing this 
legal clause into contracts with key suppliers, as 
noted by the Board of Auditors. The ESM has also 
progressed considerably in its negotiations on such 
a clause with the remaining existing suppliers and 
will strive to include the "right to audit” clause in all 
future outsourcing arrangements. The ESM’s ability 
to incorporate the clause depends however on the 
counterparty’s agreement, which may not always be 
forthcoming despite sustained ESM efforts. 

ESM RISK MANAGEMENT AUDIT 


- Distinction betvueen first and second lines 
of defence 

In April 2014, the ESM centralised all embedded 
risk functions in the Risk department. The first 
and second line of defence teams were clearly 
delineated, and a revised organisational chart of the 
Risk function has been issued and submitted to the 
Board of Auditors. 

This re-organisation completed the design of the 
ESM three lines of defence governance model 
achieving a clear separation between the first and 
second lines of defence. It was endorsed by the 
Board Risk Committee and effectively implemented 
the Board of Auditors’ recommendation. 

In addition, the ESM completed the staffing of the 
second line of defence with the recruitment of 
additional risk officers who support the established 
senior risk management team. 

With regard to the recommendation on legal 
and reputational risks, the ESM Communications 
and Legal teams already undertake a number of 
activities to actively monitor and manage these 
risks. Furthermore, the Internal Risk Committee 
exercises effective oversight over these risks. The 
Chief Spokesperson and the General Counsel attend 
all Internal Risk Committee meetings and when nec- 
essary, the ESM escalates any reputational or legal 
risk issues to the Board Risk Committee. As part 
of the Internal Control Roadmap, written operating 


procedures for managing reputational and legal 
risks have been drawn up with clearly assigned 
roles and responsibilities within these processes. 

- Further development of the risk 
management elements and policies 

The ESM Risk Policy, which the Board of Directors 
approved in September 2013, envisages several 
sub-policies with further implementation detail to be 
approved by the Internal Risk Committee and the 
ESM Managing Director. These remaining sub-poli- 
cies, as listed, are currently being finalised. The pri- 
orities in this process have been identified in the Risk 
Management Self-Assessment exercise presented 
to the Board Risk Committee on 30 June 2014. 
The ESM will conduct a second Risk Management 
Self-Assessment exercise in 201 5. 


AUDIT OF ESM LENDING OPERATIONS 


- Early Warning System 

An Early Warning System for the ESM lending portfolio 
is a requirement of the ESM Treaty and is reflected in 
the ESM High Level Principles for Risk Management 
and the ESM Risk Policy. 

The ESM designed the current Early Warning System 
in 2013. The system was subsequently discussed with 
the Board Risk Committee and approved by the Board 
of Directors in 2014. It aims to capture the ability of 
a country to cover upcoming payments to the ESM, 
and thus to prevent a situation where a repayment 
default could trigger a surprise Capital call for ESM 
Members. 

The Early Warning System was designed to be 
a streamlined process that operates with a high 
degree of reliability and accuracy, and is supported by 
all ESM Members based on the legal right of the ESM 
to demand information from a beneficiary Member 
as part of contractual information undertakings. 
Extending the data to a somewhat longer horizon 
could be beneficial to the ESM in compiling its liquidity 
assessment, taking into account that the margin of 
uncertainty increases with the projection horizon. 
Such a change can, however, only be implemented 
with the support of the ESM Members. The ESM 
will therefore approach the Board Risk Committee 
to understand its view on the provision of further 
information. In this context, the ESM will also review 
whether the Early Warning System reporting could be 
done on a quarterly basis. 
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In closing, I hope that the above comments are helpful 
as they provide the ESM management’s perspective 
on the matters raised, and illustrate the considerable 
progress and effort the ESM has made in addressing 
the Board of Auditors’ recommendations. 

The ESM is appreciative of the constructive feedback 
and support that the Board of Auditors has provided 
over the past year. Going forward, the ESM will 
continue to foster the mutually constructive, yet 
appropriately independent relationships among the 
ESM management, the Board of Auditors, as well as 
the internal and external auditors. 


The ESM management continues to be confident 
that its policies, procedures and staff will succeed in 
delivering the ESM mandate and in ensuring effective 
control mechanisms. 

I look forward to continuing our good working relation- 
ship in 2015 and beyond. 


Luxembourg, 4 June 2015, 

Klaus Regling 

Managing Director 



